Is it possible to have a time filter based on an integer field?

[OphyTe]

Hi,

I have an integer field which store a date in UNIX_MS format (number of milliseconds since epoch).
How can I do to base my time filter on it ?

Do I have to duplicate the field in a Date format ? Isn't that heavy to duplicate field in elastic just for visualization purposes ?

[Marius_Dragomir]

Elastic date fields do exactly that, store the data in UNIX_MS format. https://www.elastic.co/guide/en/elasticsearch/reference/current/date.html
At ingest you should just set this as a date field so you don't have it as integer. The purpose of a date field specifically is to handle timezones and DST based on ingest.

[OphyTe]

Unfortunately I have no choice on the field type. The elastic index is built by a client app which extract data from an Oracle database and put it in the elastic with an obscure library which rest on a mapper which convert Date into Long ... no comment

[Marius_Dragomir]

you should be able to create a scripted field in Kibana, that gets the value of that field and sets it as Date field.

[OphyTe]

I did but how can I define this Date field as the time-field on which the time filter is based?

It seems that this time field has to be define with the index pattern definition and that we can not go back on it. As for the scripted field, it's defined once the index pattern is!

Here is my scripted field :

new Date(doc['myField'].value)`

I also read somewhere that scripted field are resource gready so I'm not sure this can be a valid solution.

[Marius_Dragomir]

Yes, you are indeed right. The scripted fields will be resource intensive. Unfortunately, I can't think of any other solution that Kibana can provide for this. You can look into the Elastic ingest pipelines (but this will only work at data ingest, so you can't transform the existing data): https://www.elastic.co/blog/new-way-to-ingest-part-1 as I think they should be able to transform the integer field to a date field.